T1568.002 — Domain Generation Algorithms

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Windows

Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over…

Sub-technique of Dynamic Resolution (T1568).

Sigma detection rules (4)

title: "T1568.002 Dynamic Resolution: Domain Generation Algorithms"
id: c793a0bc-e4a5-41aa-a939-fcf508bfbd3b
description: 'Detection Strategy for Dynamic Resolution using Domain Generation Algorithms. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: EntropyThreshold, QueryFailureRate, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1568/002
author: Shahrukh Khan
date: 2026-01-13
license: MIT
tags:
  - attack.command-and-control
  - attack.t1568.002

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection_dns_longlabel:
    EventID: '22'
    QueryName|re: '^[a-z0-9]{16,}\.(top|xyz|club|info|online|site|biz|pw|ru|cc|tk|ml|ga|cf|gq)
    
  



  selection_dns_consonants:
    EventID: '22'
    QueryName|re: '[bcdfghjklmnpqrstvwxyz]{7,}'

  selection_conn_longlabel:
    EventID: '3'
    DestinationHostname|re: '^[a-z0-9]{16,}\.(top|xyz|club|info|online|site|biz|pw|ru|cc|tk|ml|ga|cf|gq)
    
  



  selection_conn_consonants:
    EventID: '3'
    DestinationHostname|re: '[bcdfghjklmnpqrstvwxyz]{7,}'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (1 of selection_*) and not filter_system_account

falsepositives:
  - Legitimate services using long random-looking hostnames under commonly-abused TLDs, or high-consonant subdomains from CDNs/ad-tech.

level: medium

title: "T1568.002 Dynamic Resolution: Domain Generation Algorithms"
id: 0584a725-750a-46c6-86a5-1a7d9457c638
description: 'Detects a Linux-observable proxy for Domain Generation Algorithm (DGA) usage. True DGA detection requires DNS resolver telemetry (NXDOMAIN ratio across many candidate domains) that auditd cannot provide - auditd sees process execution and raw connect() syscalls only, never DNS response codes. As the closest defensible proxy, this flags scripting interpreters (python3/perl/bash) directly issuing outbound connect() syscalls themselves rather than going through common network client binaries (curl/wget), a pattern consistent with malware performing its own socket-level DNS/C2 lookups in a DGA loop. Pair with a value_count correlation rule (group by parent process over a short timespan) to approximate the "many domains tried" behavior that NXDOMAINThreshold and DomainAge were meant to tune.'
references:
  - https://attack.mitre.org/techniques/T1568/002
author: Shahrukh Khan
date: 2026-05-13
license: MIT
tags:
  - attack.command-and-control
  - attack.t1568.002

logsource:
  category: network_connection
  product: linux
  service: auditd

detection:
  selection:
    type: SYSCALL
    syscall: connect
    exe|endswith:
      - '/python3'
      - '/perl'
      - '/bash'

  condition: selection

falsepositives:
  - Interpreters legitimately opening network sockets for non-malicious scripts (health checks, custom clients); this rule cannot see the destination domain name or NXDOMAIN responses at all, only that a scripting runtime issued a raw connect() - pair with connection-volume correlation and real DNS resolver logs for genuine DGA confirmation.

level: low

title: "T1568.002 Dynamic Resolution: Domain Generation Algorithms"
id: ecd419d4-c0a2-4845-8414-12280228e44c
description: 'Detection Strategy for Dynamic Resolution using Domain Generation Algorithms.. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ReputationFeedWhitelist, LexicalScoreThreshold.'
references:
  - https://attack.mitre.org/techniques/T1568/002
author: Shahrukh Khan
date: 2026-05-08
license: MIT
tags:
  - attack.command-and-control
  - attack.t1568.002

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/ping'
    CommandLine|re: '\b[bcdfghjklmnpqrstvwxyz]{6,}\.(com|net|top|xyz)\b'

  condition: selection

falsepositives:
  - Consonant-heavy heuristics like this frequently misfire on legitimate but unusual vendor or CDN hostnames; true DGA detection needs a trained lexical model that unified log telemetry alone cannot provide.

level: low

title: "T1568.002 Dynamic Resolution: Domain Generation Algorithms"
id: c2dab388-b7d3-4e92-9f54-e66aef2869b9
description: 'Detection Strategy for Dynamic Resolution using Domain Generation Algorithms.. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ResolverConfigPaths, DomainWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1568/002
author: Shahrukh Khan
date: 2026-04-23
license: MIT
tags:
  - attack.command-and-control
  - attack.t1568.002

logsource:
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'esxcli network ip dns server add'
      - '/etc/resolv.conf'

  condition: selection

falsepositives:
  - Detecting domain generation algorithm activity requires DNS query pattern analysis that ESXi host logs do not provide; this rule is only a weak proxy on resolver configuration changes and cannot evaluate the DomainWhitelist itself.

level: low

Related sub-techniques

• T1568.003 DNS Calculation
• T1568.001 Fast Flux DNS

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1568.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan